add bandit to pre-commit

[vvssttkk]

close #61

also, bump some rev's

[mike0sv]

Can you also fix bandit's warnings? We can probably ignore those in tests
Adopting #427 should fix other issues

[vvssttkk]

will try, but bandit some time have false-positive errors/warnings

[vvssttkk]

some problem resolved; for few add #nosec because refactor shell is long and users should be understand that you can't do without it
another problems suggest you decide, because put usedforsecurity=False is not good

[vvssttkk]

so, we have

• Issue: [B324:hashlib] Use of weak MD4, MD5, or SHA1 hash for security. Consider usedforsecurity=False
  Severity: High Confidence: High
  CWE: CWE-327 (https://cwe.mitre.org/data/definitions/327.html)
  Location: mlem/core/objects.py:354:15
  More Info: https://bandit.readthedocs.io/en/0.0.0/plugins/b324_hashlib.html

• Issue: [B324:hashlib] Use of weak MD4, MD5, or SHA1 hash for security. Consider usedforsecurity=False
  Severity: High Confidence: High
  CWE: CWE-327 (https://cwe.mitre.org/data/definitions/327.html)
  Location: mlem/core/artifacts.py:318:15
  More Info: https://bandit.readthedocs.io/en/0.0.0/plugins/b324_hashlib.html

put usedforsecurity=False not good, mb @mike0sv u know better solution?

[aguschin]

Sorry @vvssttkk, Mike was on vacation last week. @mike0sv, could you please TAL at @vvssttkk's last question?

[mike0sv]

@vvssttkk we dont use it for security, just to fingerprint files, so I guess usedforsecurity=False is ok for our case

[vvssttkk]

@mike0sv @aguschin thx, updated code according last bandit warning

[aguschin]

@vvssttkk, thanks. I'm re-running the CI, but looks like there are some FAILED tests. Could you please TAL?

[vvssttkk]

hmmm.. ran local the tests/contrib/test_docker/test_context.py::test_dockerfile_generator_super_custom and did not get any error. they work normal, because made an intentional mistake and get the error

[aguschin]

ok, was trying to merge with release/0.3.0 since this is a new upcoming release, but abandoned the idea since more issues emerged.

[aguschin]

Seeing other failed tests now as well.
@vvssttkk, could I ask you to create another PR with your changes on top of release/0.3.0?